From c95f5b6dedaf857f9bc8387d24f857a32115627b Mon Sep 17 00:00:00 2001
From: Mikhail Avramenko <avramenkomihail15@gmail.com>
Date: Mon, 7 Jun 2021 12:38:53 +0700
Subject: [PATCH 1/2] added local forwarder healing example

Signed-off-by: Mikhail Avramenko <avramenkomihail15@gmail.com>
---
 .../use-cases/LocalForwarderHealing/README.md | 159 ++++++++++++++++++
 1 file changed, 159 insertions(+)
 create mode 100644 examples/use-cases/LocalForwarderHealing/README.md

diff --git a/examples/use-cases/LocalForwarderHealing/README.md b/examples/use-cases/LocalForwarderHealing/README.md
new file mode 100644
index 000000000000..ef97295e7806
--- /dev/null
+++ b/examples/use-cases/LocalForwarderHealing/README.md
@@ -0,0 +1,159 @@
+# Test kernel to kernel connection
+
+
+This example shows that NSC and NSE on the one node can find each other.
+
+NSC and NSE are using the `kernel` mechanism to connect to its local forwarder.
+
+## Requires
+
+Make sure that you have completed steps from [basic](../../basic) or [memory](../../memory) setup.
+
+## Run
+
+Create test namespace:
+```bash
+NAMESPACE=($(kubectl create -f ../namespace.yaml)[0])
+NAMESPACE=${NAMESPACE:10}
+```
+
+Register namespace in `spire` server:
+```bash
+kubectl exec -n spire spire-server-0 -- \
+/opt/spire/bin/spire-server entry create \
+-spiffeID spiffe://example.org/ns/${NAMESPACE}/sa/default \
+-parentID spiffe://example.org/ns/spire/sa/spire-agent \
+-selector k8s:ns:${NAMESPACE} \
+-selector k8s:sa:default
+```
+
+Select node to deploy NSC and NSE:
+```bash
+NODE=($(kubectl get nodes -o go-template='{{range .items}}{{ if not .spec.taints  }}{{index .metadata.labels "kubernetes.io/hostname"}} {{end}}{{end}}')[0])
+```
+
+Create customization file:
+```bash
+cat > kustomization.yaml <<EOF
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: ${NAMESPACE}
+
+bases:
+- ../../../apps/nsc-kernel
+- ../../../apps/nse-kernel
+
+patchesStrategicMerge:
+- patch-nsc.yaml
+- patch-nse.yaml
+EOF
+```
+
+Create NSC patch:
+```bash
+cat > patch-nsc.yaml <<EOF
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nsc-kernel
+spec:
+  template:
+    spec:
+      containers:
+        - name: nsc
+          env:
+            - name: NSM_NETWORK_SERVICES
+              value: kernel://icmp-responder/nsm-1
+      nodeSelector:
+        kubernetes.io/hostname: ${NODE}
+EOF
+```
+
+Create NSE patch:
+```bash
+cat > patch-nse.yaml <<EOF
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nse-kernel
+spec:
+  template:
+    spec:
+      containers:
+        - name: nse
+          env:
+            - name: NSE_CIDR_PREFIX
+              value: 172.16.1.100/30
+      nodeSelector:
+        kubernetes.io/hostname: ${NODE}
+EOF
+```
+
+Deploy NSC and NSE:
+```bash
+kubectl apply -k .
+```
+
+Wait for applications ready:
+```bash
+kubectl wait --for=condition=ready --timeout=1m pod -l app=nsc-kernel -n ${NAMESPACE}
+```
+```bash
+kubectl wait --for=condition=ready --timeout=1m pod -l app=nse-kernel -n ${NAMESPACE}
+```
+
+Find nsc and nse pods by labels:
+```bash
+NSC=$(kubectl get pods -l app=nsc-kernel -n ${NAMESPACE} --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}')
+```
+```bash
+NSE=$(kubectl get pods -l app=nse-kernel -n ${NAMESPACE} --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}')
+```
+
+Ping from NSC to NSE:
+```bash
+kubectl exec ${NSC} -n ${NAMESPACE} -- ping -c 4 172.16.1.100
+```
+
+Ping from NSE to NSC:
+```bash
+kubectl exec ${NSE} -n ${NAMESPACE} -- ping -c 4 172.16.1.101
+```
+
+Find local forwarder
+```bash
+FORWARDER=$(kubectl get pods -l app=forwarder-vpp --field-selector spec.nodeName==${NODES[0]} -n nsm-system --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}')
+```
+
+Remove local forwarder
+```bash
+kubectl delete pod -n=nsm-system ${FORWARDER}
+```
+
+Ping from NSC to NSE again after forwarder restored:
+```bash
+sleep 70
+kubectl exec ${NSC} -n ${NAMESPACE} -- ping -c 4 172.16.1.100
+```
+```bash
+kubectl exec ${NSC} -n ${NAMESPACE} -- ping -c 4 172.16.1.102
+```
+
+Ping from NSE to NSC:
+```bash
+kubectl exec ${NSE} -n ${NAMESPACE} -- ping -c 4 172.16.1.101
+```
+```bash
+kubectl exec ${NSE} -n ${NAMESPACE} -- ping -c 4 172.16.1.103
+```
+
+## Cleanup
+
+Delete ns:
+```bash
+kubectl delete ns ${NAMESPACE}
+```
\ No newline at end of file

From ae53113262c540fe9fab6976c50783aeeee11dc2 Mon Sep 17 00:00:00 2001
From: Mikhail Avramenko <avramenkomihail15@gmail.com>
Date: Mon, 7 Jun 2021 15:14:18 +0700
Subject: [PATCH 2/2] refactoring of forwarder healing example

Signed-off-by: Mikhail Avramenko <avramenkomihail15@gmail.com>
---
 examples/heal/README.md                               | 11 +++++++++++
 .../local-forwarder-healing}/README.md                |  5 ++---
 examples/heal/namespace.yaml                          |  5 +++++
 3 files changed, 18 insertions(+), 3 deletions(-)
 create mode 100644 examples/heal/README.md
 rename examples/{use-cases/LocalForwarderHealing => heal/local-forwarder-healing}/README.md (96%)
 create mode 100644 examples/heal/namespace.yaml

diff --git a/examples/heal/README.md b/examples/heal/README.md
new file mode 100644
index 000000000000..07c96039ed0f
--- /dev/null
+++ b/examples/heal/README.md
@@ -0,0 +1,11 @@
+# Heal examples
+
+This document contain links for heal examples of NSM. 
+
+## Requires
+
+To run any heal example follow steps for [Basic NSM setup](../basic)
+
+## Includes
+
+- [Local Forwarder restart](./local-forwarder-healing)
\ No newline at end of file
diff --git a/examples/use-cases/LocalForwarderHealing/README.md b/examples/heal/local-forwarder-healing/README.md
similarity index 96%
rename from examples/use-cases/LocalForwarderHealing/README.md
rename to examples/heal/local-forwarder-healing/README.md
index ef97295e7806..121236946a45 100644
--- a/examples/use-cases/LocalForwarderHealing/README.md
+++ b/examples/heal/local-forwarder-healing/README.md
@@ -1,7 +1,6 @@
-# Test kernel to kernel connection
+# Test local forwarder restart
 
-
-This example shows that NSC and NSE on the one node can find each other.
+This example shows that NSM keeps working after the local Forwarder restart.
 
 NSC and NSE are using the `kernel` mechanism to connect to its local forwarder.
 
diff --git a/examples/heal/namespace.yaml b/examples/heal/namespace.yaml
new file mode 100644
index 000000000000..7919ccab9bec
--- /dev/null
+++ b/examples/heal/namespace.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  generateName: ns-